From d04759b2420b57ebad3c6876cbec7334980c2a0a Mon Sep 17 00:00:00 2001 From: cypherpunk Date: Wed, 15 Jan 2014 00:20:52 +0100 Subject: [PATCH] fixed AutoFixIATExW, now it can dump again --- TitanEngine/TitanEngine.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/TitanEngine/TitanEngine.cpp b/TitanEngine/TitanEngine.cpp index b5ac661..5f7929f 100644 --- a/TitanEngine/TitanEngine.cpp +++ b/TitanEngine/TitanEngine.cpp @@ -19570,14 +19570,15 @@ __declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, wchar_ lstrcat(DumpFileName, Extension); //do we need to dump first? - /* TODO if(DumpRunningProcess) { + HANDLE hProcess = OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, FALSE, ProcessId); + if(!DumpProcessW(hProcess, (LPVOID)ImageBase, szDumpedFile, EntryPointAddress)) { return(NULL); // Critical error! *just to be safe, but it should never happen! } - }*/ + } //we need to fix iat, thats for sure int ret = scylla_searchIAT(ProcessId, iatStart, iatSize, SearchStart, false);